New PamStealer variant targets macOS via fake crypto wallet

Reported 22 Sep 2026 by otx · Severity: medium

A third variant of PamStealer has been identified, distributed through a fake Wavel cryptocurrency wallet application. The malware employs a sophisticated server-side decryption chain using a purpose-built utility called pkgunpack that performs live ECIES key exchange with comman